Security & data handling

Every customer workspace is a firm. Other firms cannot see your projects, members, chat, or Vault files. The application enforces tenant scope on every query. Vault objects in Backblaze B2 are stored under a firm-prefixed path ({firmId}/vault/...) and encrypted with a per-firm AES-256 key (SSE-C). Isolation is by access control, object-key prefix, and firm-scoped encryption keys — not by giving each firm a separate cloud account.

In transit: all browser traffic to Beech uses TLS. Vault uploads use HTTPS (presigned multipart parts to Backblaze B2 with firm-key headers, or via the Beech app). Downloads for shares, chat, zip packages, and malware scanning stream through Beech when the firm key must stay server-side; authenticated in-app downloads may use short-lived signed URLs with the same customer-key headers.

At rest (Vault objects): Beech stores Vault files on Backblaze B2 with AES-256 encryption using a per-firm data key (SSE-C). Each firm's key is wrapped by Beech and never stored as plaintext. Backblaze cannot decrypt object bytes without keys Beech supplies on each request. Every new object write from Beech uses that firm key; older objects are migrated automatically.

At rest (secrets): MFA secrets and integration OAuth tokens are encrypted with AES-256-GCM before they are stored in the database.

This is application-managed encryption at rest — stronger isolation than provider-only bucket keys. It is not end-to-end encryption and not client-held-only keys. Beech can decrypt object bytes when authorized access is required for the product (malware scan, zip packages, support).

Beech uses three permission tiers — Admin, Manager, and Contributor — combined with project membership:

• Project Vault: any member of the project (Admin, Manager, or Contributor) can upload, organise, and trash files. Admins can open every project's Vault.
• Firm Library: every firm member can browse; only Admins can upload or organise.
• External package links: by default, any project member can create, revoke, and manage public Deliverables links (token + optional password + expiry). Firm Admins can restrict external sharing to Admins and Managers only from Firm settings → Vault. Public links intentionally bypass login — anyone with the link (and password, if set) can download until the link is revoked or expired.

There is no ad-hoc engineer access to customer Vault objects or production databases for curiosity or convenience. Authorized operators may enter a customer workspace only for support, maintenance, or a confirmed security incident — and only through audited super-admin impersonation.

When that happens, the firm's Admin audit log records a Beech support session start and end against the impersonated member. Vault object keys are held by Beech (wrapped per firm); Backblaze never holds the firm DEKs.

Firm Admins can open Firm settings → Audit log to see who accessed what. Events include Vault file upload, download, delete, restore, move, and rename; package create / share / revoke / extend / delete; external share view and download; Vault share-policy changes; and Beech support sessions. Events are retained for one year. Folder browsing and list views are not logged (to keep the trail useful).

The same screen lists active external shares — project, package, creator and role, expiry, password, and view/download counts — so Admins can revoke a link without hunting through projects.

Uploads are type-checked. When malware scanning is configured, files are scanned before they become downloadable; infected files are blocked.

Access requires an authenticated account (password or supported OAuth), an invite to join a firm, and firm-scoped sessions. Optional MFA is available. Role changes take effect on the next action.

Vault object storage runs on Backblaze B2. The application database runs on Neon. The current list of subprocessors is published on Subprocessors.

Firm Admins can export core firm data and request firm deletion (7-day grace period) from Firm settings → Data & Privacy. See also the Privacy Policy and Data Processing Addendum.

Beech ships encryption in transit and at rest (AES-256 per-firm keys on Vault objects), role-based access, optional MFA, Vault audit logging, a DPA, and malware scanning when configured. Formal third-party certification programs are not claimed on this page.

Security questions: [email protected]